Loading story…
A high-severity vulnerability tracked as CVE-2026-66398 affects phpMyFAQ versions before 4.1.6, allowing authenticated remote code execution through the application's configuration API. The flaw requires an administrator account with the CONFIGURATION_EDIT and ATTACHMENT_ADD privileges, and stems from unsafe handling of the upgrade.lastDownloadedPackage setting during the update process.
An attacker can exploit the issue by uploading a malicious ZIP archive as an attachment, repointing the updater configuration to that stored file path, and triggering extraction into the application root so arbitrary PHP files are written and executed. Successful exploitation yields code execution as the web server user, with reported impact spanning confidentiality, integrity, and availability; phpMyFAQ 4.1.6 is listed as unaffected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A remote code execution vulnerability affecting phpMyFAQ versions before 4.1.6 was disclosed. The flaw in the configuration API lets an authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges write arbitrary PHP files via the upgrade.lastDownloadedPackage setting and achieve code execution as the web server user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through **3.3.16** and **4.0.0-a2**, and stems from trust in the `PHP_AUTH_USER` value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using `login_link` and `auth_provider=apache`, causing phpBB to treat supplied credentials as authenticated under affected configurations. Researchers said compromise of an administrator account can lead to **remote code execution** and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in **3.3.17** and advised users of **4.0.0-a2** to move to the development `master` branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Jun 29, 2026
A public advisory disclosed **CVE-2026-29014**, an unauthenticated PHP code injection vulnerability in **MetInfo CMS** versions **7.9, 8.0, and 8.1**. The flaw affects `weixinreply.class.php`, specifically the `weixinreply::wxAdminLogin()` method, where attacker-controlled `EventKey` and `FromUserName` XML fields are insufficiently sanitized before being passed to cache handling functions. The issue allows path traversal and arbitrary cache file inclusion, enabling attackers to write malicious PHP into `/cache/weixin/Array.php` and achieve remote code execution. The vulnerability was discovered by **Egidio Romano** and was publicly disclosed after the vendor reportedly did not respond to multiple contact attempts. Exploitation on non-Windows systems requires the `/cache/weixin/` directory to exist, a condition typically met when the official **WeChat plugin** is installed and configured. One advisory said no official patch was available at disclosure, while a later vendor update indicated a fix was released on **2026-04-07**.
Jun 29, 2026
High-severity vulnerabilities have been disclosed for **PhreeBooks ERP 5.2.3** and **phpBB**, both allowing authenticated attackers to turn file upload functionality into remote code execution. In **CVE-2019-25630**, an attacker can abuse the `imgFile` parameter in the `bizuno/image/manager` endpoint to upload a malicious PHP file and then execute it through `bizunoFS.php`. The issue affects the Image Manager component in PhreeBooks ERP and was rated high impact under both CVSS v3.1 and v4.0. A separate flaw, **CVE-2019-25685**, affects phpBB and uses `plupload` together with the `phar://` stream wrapper to upload a crafted ZIP archive containing serialized PHP objects. When those objects are later deserialized via the `imagick` parameter in attachment settings, arbitrary code can be executed on the server. References tied to the disclosures include **Exploit-DB** and **VulnCheck**, indicating public technical detail is available for both upload-to-RCE attack paths.
Jun 29, 2026